Quartz 4

🌐 Network Overview

4 min read

Network Overview

Home lab network infrastructure.

Network Details

PropertyValue
Subnet192.168.1.0/24
Gateway192.168.1.1
DNS192.168.1.50 (Pi-hole + Unbound recursive)
RouterASUS RT-AX82U

🖥️ Hosts (Verified 2026-02-02)

IPHostnameTypePurposePorts
192.168.1.1GatewayRouterASUS RT-AX82U—
192.168.1.10npmLXCNginx Proxy Manager (OpenResty)22, 80, 81, 443
192.168.1.16clawdbotLXCOld Clawdbot/SOTCD container22
192.168.1.20docker1LXCDocker stack (Portainer, Uptime Kuma, Vaultwarden)22, 8080
192.168.1.50piholeLXCPi-hole DNS + ad blocking22, 53, 80, 443
192.168.1.60wireguardLXCWireGuard VPN Server22, 51821/UDP
192.168.1.144proxmoxBare metalProxmox VE Hypervisor22, 8006
192.168.1.156pop-osBare metalMain workstation22, 3030, 8000, 8081, 32400
192.168.1.214ShadowMasterWindowsDJ Bot / Stream PC22, 8080

💾 Storage Allocations

PathPurposeSize
/mnt/storage/knowledge-rag/chroma_dbChromaDB vector store16GB+ (growing)
/mnt/storage/books_organizedBook corpus for RAG~500GB
/mnt/storage/QB_kruse_pateronQuantum Biology corpusTBD

ChromaDB migrated 2026-02-02 from root drive to prevent exhaustion

🐳 Docker Services

pop-os (192.168.1.156) - Local Workstation

ContainerPortPurpose
plex32400Media server
paperless8000Document management
stirling-pdf8081PDF tools
paperless-redis6379 (internal)Redis for Paperless
ollama11434 (localhost)Local LLM inference

docker1 (192.168.1.20)

ContainerPortPurpose
Portainer8080Docker management
Uptime KumaTBDStatus monitoring
VaultwardenTBDPassword manager

🔐 VPN Configuration

NordVPN (pop-os Local) - WORKING CONFIG (2026-02-03)

SettingValueNotes
TechnologyNordLynx (WireGuard)
Routingenabled✅ Works with proper allowlists
FirewallenabledRequired by Kill Switch
Kill Switchenabled
DNS192.168.1.1Router/Pi-hole
LAN DiscoverydisabledMust be OFF to use subnet allowlists

Allowlisted Subnets:

192.168.1.0/24   # LAN + Pi-hole
172.17.0.0/16    # Docker bridge
172.18.0.0/16    # Docker bridge  
172.19.0.0/16    # Docker bridge
127.0.0.0/8      # Localhost

Allowlisted Ports:

53/UDP       # DNS (Pi-hole)
3030/UDP+TCP # Quartz (NPM proxy)
8096/UDP+TCP # Jellyfin

Pi-hole Whitelist (REQUIRED):

api.telegram.org
telegram.org
api.anthropic.com
anthropic.com

✅ Fixed 2026-02-02: VPN routing works when Pi-hole has API domains whitelisted and NordVPN has LAN/Docker subnets allowlisted. LAN Discovery must be OFF to use subnet allowlists.

WireGuard Server (192.168.1.60)

PropertyValue
Port51821/UDP (custom, default+1)
Router forward51821/UDP → 192.168.1.60:51821

🌍 Domain & DNS

Domain Assets

DomainRegistrarPurposeStatus
shdwnet.orgPorkbunThe Signal from SOTCD project✅ VPS only
shdwnet.cloudPorkbunInfrastructure + reverse proxy services✅ Live

GitHub Repos

RepoPurposeDeployment
red40mademedoit/shdwnet.orgThe Signal sourceVPS (manual)
red40mademedoit/notes.shdwnet.orgQuartz notes sourceLocal PM2 (version control only)

✅ Migration Complete (2026-02-03)

All reverse proxies migrated from shdwnet.org → shdwnet.cloud. Both domains operational.

DomainPurpose
shdwnet.orgThe Signal from SOTCD (VPS only)
notes.shdwnet.cloudQuartz/Obsidian notes (local PM2 + NPM)
*.shdwnet.cloudAll reverse proxy services

Cleanup performed 2026-02-03:

  • ❌ Deleted Cloudflare Pages project notes-shdwnet-org (was deploying to wrong domain)
  • ❌ Disabled GitHub Pages on red40mademedoit/shdwnet.org repo (placeholder no longer needed)
  • ✅ Notes now served locally: PM2 (npx quartz build --serve) → NPM → notes.shdwnet.cloud
  • ✅ Port 3030 added to NordVPN allowlist for NPM→Quartz connectivity

Internal DNS (Pi-hole v6) - Split-Horizon Setup

See Split-Horizon DNS Guide for full details.

HostnameIPNotes
pi.hole192.168.1.50Pi-hole admin
shdwnet.cloud192.168.1.10→ NPM (root)
notes.shdwnet.cloud192.168.1.10→ NPM → Quartz (PM2 :3030)
plex.shdwnet.cloud192.168.1.10→ NPM → Plex
vault.shdwnet.cloud192.168.1.10→ NPM → Vaultwarden
uptime.shdwnet.cloud192.168.1.10→ NPM → Uptime Kuma
pulse.shdwnet.cloud192.168.1.10→ NPM → Uptime Kuma (alias)
paperless.shdwnet.cloud192.168.1.10→ NPM → Paperless-ngx
portainer.shdwnet.cloud192.168.1.10→ NPM → Portainer
netdata.shdwnet.cloud192.168.1.10→ NPM → VPS:19998
proxmox.shdwnet.cloud192.168.1.144Direct (internal only)

Active shdwnet.cloud Subdomains (NPM)

SubdomainTargetServiceSSL
notes.shdwnet.cloudpop-os:3030Quartz notes✅
plex.shdwnet.cloudpop-os:32400Plex✅
paperless.shdwnet.cloudpop-os:8000Paperless-ngx✅
vault.shdwnet.clouddocker1:443Vaultwarden✅
uptime.shdwnet.clouddocker1:3001Uptime Kuma✅
pulse.shdwnet.clouddocker1:3001Uptime Kuma (alias)✅
portainer.shdwnet.clouddocker1:9443Portainer✅
netdata.shdwnet.cloudVPS:19998Netdata monitoring✅

🏗️ Architecture

Internet
    │
    ├── shdwnet.org (Cloudflare → VPS) ✅ LIVE
    │    └── The Signal from SOTCD (SHDWNET Dashboard)
    │
    ├── shdwnet.cloud (Cloudflare → NPM) ✅ LIVE
    │    ├── notes.shdwnet.cloud → pop-os:3030 (Quartz)
    │    ├── plex.shdwnet.cloud → pop-os:32400
    │    ├── paperless.shdwnet.cloud → pop-os:8000
    │    ├── vault.shdwnet.cloud → docker1:443
    │    ├── uptime/pulse.shdwnet.cloud → docker1:3001
    │    ├── portainer.shdwnet.cloud → docker1:9443
    │    └── netdata.shdwnet.cloud → VPS:19998
    │    ├── uptime.shdwnet.cloud → docker1:uptime
    │    └── paperless.shdwnet.cloud → pop-os:8000
    │
    └── Router / Gateway (192.168.1.1)
         │
         ├── NPM Reverse Proxy (.10)
         │    └── *.shdwnet.cloud → internal services
         │
         ├── WireGuard VPN (.60:51821/UDP)
         │
         ├── Pi-hole DNS (.50)
         │
         ├── docker1 (.20)
         │    ├── Portainer
         │    ├── Uptime Kuma
         │    └── Vaultwarden
         │
         ├── Proxmox Hypervisor (.144)
         │    ├── LXC: NPM (.10)
         │    ├── LXC: Pi-hole (.50)
         │    ├── LXC: WireGuard (.60)
         │    ├── LXC: docker1 (.20)
         │    └── LXC: clawdbot (.16) [legacy]
         │
         ├── Pop!_OS Workstation (.156)
         │    ├── Docker: Plex, Paperless, Stirling
         │    ├── Ollama (localhost)
         │    └── NordVPN (NordLynx)
         │
         └── ShadowMaster Windows (.214)
              └── SuperCollider / SOTCD Stream

🔧 SSH Access Quick Reference

# Proxmox hosts (key: github_ed25519)
ssh -i ~/.ssh/github_ed25519 root@192.168.1.16   # clawdbot
ssh -i ~/.ssh/github_ed25519 root@192.168.1.10   # npm (if configured)
 
# docker1
ssh root@192.168.1.20
 
# ShadowMaster (Windows)
ssh -i ~/.ssh/id_ed25519 shdwadmin@192.168.1.214

📝 Notes

  • NordVPN + LAN Issue: NordVPN routing conflicts with local Docker/DNS. Keep routing disabled or configure split tunneling.
  • clawdbot (.16): Legacy container, old SOTCD configs at /root/.moltbot/ and /root/clawd/
  • WireGuard custom port: Using 51821 instead of 51820 to avoid conflicts

Graph View

Backlinks